Imagine I have a web site running on an IIS. The web site needs to get/send sensitive data from a 3rd party REST web service.
Is there any reason why a web site (server side, not client side) should not be allowed to consume a 3rd party web service directly, but a separate internal service that makes the call to the 3rd party web service?
Web Site --> 3rd party party web service
Web Site --> internal service --> 3rd party web service